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Claims : 

This listing of claims will replace all prior versions, and listings, of claims in the application. 

1 . (Original) A method of reducing spread of data on a network, comprising: 

obtaining a spectral analysis of times of arrival of data packets at receiving 
nodes of said network from sending nodes of said network over predetermined time periods; 

for each pair of sending node and receiving node, marking transmissions of 
data packets for said pair as marked transmissions when said spectral analysis indicates peak 
frequencies associated with said marked transmissions are different from peak frequencies 
associated with others of said transmissions for said pair over a window of a predetermined number 
of said time periods; 

marking transmissions of data packets as interruptible transmissions when 
marked transmissions from pairs having at least one of a common sending node and a common 
receiving node and within a specified number of said windows have corresponding frequencies; 

estimating timing and length information for future data packets 
corresponding to said interruptible transmissions; and 

interrupting traffic of said future data packets based on said estimating. 

2. (Original) The method of claim 1, wherein obtaining a spectral analysis 

comprises: 

tracking times of arrival data; 

transforming said times of arrival data into time-series; 
parsing said time-series into said windows; and 
obtaining Lomb periodograms for said windows. 

3. (Original) The method of claim 1, wherein estimating comprises applying a 
Hidden Markov Model technique for classifying said interruptible transmissions as belonging to one 
of a plurality of classes of transmissions having determinable characteristics. 

2 

NY2 - 490836.01 



Docket No.: 03-4025 
ApplNo.: 10/826,620 



4. (Original) The method of claim 1, wherein interrupting comprises randomly 
removing data packets. 

5. (Original) The method of claim 4, comprising: 

interrupting for a specified time; and 

determining, after said specified time, if a further spectral analysis of times of 
arrival of data packets since beginning said interrupting indicates said peak frequencies associated 
with said marked transmissions. 

6. (Original) The method of claim 5, comprising returning to estimating based on 
said further spectral analysis when said further spectral analysis indicates said peak frequencies 
associated with said marked transmissions. 

7. (Original) The method of claim 4, wherein obtaining a spectral analysis 

comprises: 

tracking times of arrival data; 

transforming said times of arrival data into time-series; 
parsing said time-series into said windows; and 
obtaining Lomb periodograms for said windows. 

8. (Original) A method of reducing spread of data on a network, comprising: 

obtaining, at a receiver node of said network, periodograms based on times of 
arrival of data packets from a sender node of said network; 

comparing peak frequencies in successive ones of said periodograms for said 
sender node to determine if one of said periodograms includes a peak above a threshold at a 
frequency different from said peak frequencies in a preceding one of said periodograms; 

determining if at least one peak above said threshold at said frequency occurs 
in one of a predetermined number of previous periodograms for said sender node; 

determining if said at least one peak at said frequency occurs in at least one 

of a specified number of periodograms obtained at said receiver node for other sender nodes of said 
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network; 

estimating timing and length information for future data packets 
corresponding to said frequency when said at least one peak at said frequency does not occur in one 
of said predetermined number of previous periodograms for said sender node and when said at least 
one peak at said frequency occurs in at least one of said specified number of periodograms obtained 
at said receiver node for other sender nodes of said network; and 

interrupting traffic of said future data packets corresponding to said 
frequency based on said estimating. 

9. (Original) The method of claim 8, wherein obtaining said periodograms 

comprises: 

tracking times of arrival data; 

transforming said times of arrival data into time-series; 
parsing said time-series into windows; and 
obtaining Lomb periodograms for said windows. 

10. (Original) The method of claim 8, wherein said estimating comprises classifying 
a data stream for said at least one peak at said frequency based on said periodograms using a 
Hidden Markov Model. 

1 1 . (Original) The method of claim 8, wherein interrupting comprises: 

randomly removing data packets for a specified time; 

determining, after said specified time, if said at least one peak at said 
frequency occurs in at least one additional periodogram based on times of arrival of data packets 
since beginning said interrupting; and 

returning to estimating based on including said additional periodograms with 
said specified number of periodograms when said at least one peak at said frequency occurs in said 
at least one additional periodogram. 

12. (Original) A method of reducing spread of data on a network, comprising: 
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obtaining, at a router node of said network, periodograms based on times of 
arrival of data packets from a sender node of said network; 

comparing successive periodograms for said sender node to determine when 
at least one new peak above a threshold is present in one of said periodograms; 

determining if said at least one new peak occurs in one of a predetermined 
number of previous periodograms for said sender node; 

determining if said at least one new peak occurs in at least one of a specified 
number of periodograms obtained at said router node for other sender nodes of said network; 

estimating timing and length information for future data packets 
corresponding to said at least one new peak when said at least one new peak does not occur in one 
of a predetermined number of previous periodograms for said sender node and when said at least 
one new peak occurs in at least one of said specified number of periodograms obtained at said 
router node for other sender nodes of said network; and 

interrupting traffic of said data packets corresponding to said at least one new 
peak based on said estimating. 

13. (Original) The method of claim 12, wherein interrupting comprises randomly 
removing data packets for a specified time. 

14. (Original) The method of claim 13, wherein obtaining said periodograms 

comprises: 

tracking times of arrival data; 

transforming said times of arrival data into time-series; 
parsing said time-series into windows; and 
obtaining Lomb periodograms for said windows. 

15. (Original) The method of claim 14, wherein said estimating comprises 
classifying a data stream for said at least one new peak based on said periodograms using a Hidden 
Markov Model. 
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16. (Withdrawn) A method of classifying disruptive data packet traffic flow on a 
network, comprising: 

obtaining at a router, periodograms based on times of arrival of said data 
packets from nodes of said network; 

comparing successive periodograms for each of said nodes to determine 
when at least one new peak above a threshold is present in one of said periodograms for one of said 
nodes; 

marking said at least one new peak as a suspicious peak when said at least 
one new peak does not occur in one of a predetermined number of previous periodograms for said 
one of said nodes; 

determining if said suspicious peak occurs in at least one of a specified 
number of periodograms obtained at said router for others of said nodes of said network; 

determining if said suspicious peak occurs in at least one of said specified 
number of periodograms obtained at other routers for said one of said nodes; and 

providing a signal to classify traffic flow corresponding to said suspicious 
peak as disruptive traffic flow when said suspicious peak occurs at least in at least one of said 
specified number of periodograms obtained at said router for said others of said nodes and in at least 
one of said specified number of periodograms obtained at said other routers for said one of said 
nodes. 

17. (Withdrawn) A computer-readable medium containing instructions for 
controlling a processor to classify disruptive data packet traffic flow, by: 

obtaining at a router, periodograms based on times of arrival of said data 
packets from nodes of said network; 

comparing successive periodograms for each of said nodes to determine 
when at least one new peak above a threshold is present in one of said periodograms for one of said 
nodes; 

marking said at least one new peak as a suspicious peak when said at least 
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one new peak does not occur in one of a predetermined number of previous periodograms for said 
one of said nodes; 

determining if said suspicious peak occurs in at least one of a specified 
number of periodograms obtained at said router for others of said nodes of said network; 

determining if said suspicious peak occurs in at least one of said specified 
number of periodograms obtained at other routers for said one of said nodes; and 

providing a signal to classify traffic flow corresponding to said suspicious 
peak as disruptive traffic flow when said suspicious peak occurs at least in at least one of said 
specified number of periodograms obtained at said router for said others of said nodes and in at least 
one of said specified number of periodograms obtained at said other routers for said one of said 
nodes. 

18. (Withdrawn) The computer-readable medium of claim 17, further containing 
instructions for controlling said processor to obtain said periodograms, by: 

tracking times of arrival data; 

transforming said times of arrival data into time-series; 
parsing said time-series into windows; and 
obtaining Lomb periodograms for said windows. 

19. (Withdrawn) The computer-readable medium of claim 17, further containing 
instructions for controlling said processor to provide a signal to classify traffic flow using a Hidden 
Markov Model. 

20. (Withdrawn) The computer-readable medium of claim 17, further containing 
instructions for controlling said processor to interrupt, by: 

randomly removing data packets for a specified time; 

determining, after said specified time, if said at least one peak at said 
frequency occurs in at least one additional periodogram based on times of arrival of data packets 
since beginning said interrupting; and 
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returning to estimating based on including said additional periodograms with 
said specified number of periodograms when said at least one peak at said frequency occurs in said 
at least one additional periodogram. 

21. (Original) A computer program, disposed on a computer-readable medium, for 
reducing spread of data on a network, said computer program including instructions for causing a 
processor to: 

obtain a spectral analysis of times of arrival of data packets at receiving 
nodes of said network from sending nodes of said network over predetermined time periods; 

for each pair of sending node and receiving node, mark transmissions of data 
packets for said pair as marked transmissions when said spectral analysis indicates peak frequencies 
associated with said marked transmissions are different from peak frequencies associated with 
others of said transmissions for said pair over a window of a predetermined number of said time 
periods; 

mark transmissions of data packets as interruptible transmissions when 
marked transmissions from pairs having at least one of a common sending node and a common 
receiving node and within a specified number of said windows have corresponding frequencies; 

estimate timing and length information for future data packets corresponding 
to said interruptible transmissions; and 

interrupt traffic of said future data packets based on said estimating. 

22. (Original) The computer program of claim 21 , wherein said instructions to 
obtain a spectral analysis comprise instructions to: 

track times of arrival data; 

transform said times of arrival data into time-series; 
parse said time-series into said windows; and 
obtain Lomb periodograms for said windows. 

23. (Original) The computer program of claim 21 , wherein said instructions to 
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estimate comprise instructions to apply a Hidden Markov Model technique to classify said 
interruptible transmissions as belonging to one of a plurality of classes of transmissions having 
determinable characteristics. 

24. (Original) The computer program of claim 21 , wherein said instructions to 
interrupt comprise instructions to randomly remove data packets. 

25. (Original) The computer program of claim 24, wherein said instructions to 
interrupt further comprise instructions to: 

interrupt for a specified time; and 

determine, after said specified time, if a further spectral analysis of times of 
arrival of data packets since beginning to interrupt indicates said peak frequencies associated with 
said marked transmissions. 

26. (Original) The computer program of claim 25, wherein said instructions to 
interrupt further comprise instructions to repeat said instructions to estimate based on said further 
spectral analysis when said further spectral analysis indicates said peak frequencies associated with 
said marked transmissions. 
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